[17734] in cryptography@c2.net mail archive
Re: Why Blockbuster looks at your ID.
daemon@ATHENA.MIT.EDU (Steven M. Bellovin)
Sat Jul 9 13:27:20 2005
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
From: "Steven M. Bellovin" <smb@cs.columbia.edu>
To: John Levine <johnl@iecc.com>
Cc: cryptography@metzdowd.com, perry@piermont.com
In-Reply-To: Your message of "09 Jul 2005 12:32:04 -0000."
<20050709123204.23173.qmail@xuxa.iecc.com>
Date: Sat, 09 Jul 2005 11:37:04 -0400
In message <20050709123204.23173.qmail@xuxa.iecc.com>, John Levine writes:
>>Why does the clerk at Blockbuster want to see your driver's license?
>>Because his management has been told, by their bank, that if they do
>>not attempt to verify the identity of credit card users they will
>>risk their business relationship with the bank.
>
>It's been my impression that the way you're supposed to verify the ID
>of a credit card user is by checking the signature. I've heard of
>banks telling businesses not to demand separate ID. On the other
>hand, I can easily believe that Blockbuster came up with the ID idea
>all by themselves.
I very rarely rent from Blockbuster, so I may have the details wrong; I
can state for sure how things work at the local video store I usually
patronize.
When I signed up with them, I supplied a credit card number; they
retained that for contingency charges if I fail to return a video.
(Odd -- my local library doesn't do that. But I digress.) In return,
they handed me an account-linked credential -- exactly the sort of
thing that is often advocated on this list.
>From my perspective, the form factor of the credential wasn't ideal; it
was one of those key ring-sized cards, and I soon lost it, probably
during a wallet upgrade. No problem -- they're happy to fall back to
the secondary authentication system, to whit my drivers' license. I
show that to get access to the account, independent of how I actually
pay for the rental. In other words, they are not using my license to
authenticate my credit card. (I would add that the feeds are low
enought that I almost always pay in cash; I have no idea if they even
have the ability to use the stored credit card for rental fees if I
don't present the card separately. Hmm -- the account is old enough
that the expiration date on my credit card has long since expired.
They've never asked me for an update. Maybe they're using a reputation
system?)
--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
